hikvision-tooling

README

SADP - Hikvision Device Discovery Tool

A cross-platform command-line tool for discovering and managing Hikvision devices on your network using the SADP (Search Active Devices Protocol) and ARP-based discovery methods.

Why This Tool

Hikvision provides an official SADP Tool (SADPTool.exe) for device discovery and configuration, but it only runs on Windows. You can download it from the Hikvision SADP Tool page.

This project provides a cross-platform alternative that runs natively on:

• macOS (Intel and Apple Silicon)
• Linux (amd64 and arm64)
• Windows (amd64)

Once devices are discovered, sadp isapi info pulls structured device info via Hikvision's ISAPI over HTTP Digest auth.

Features

• SADP Discovery: Discover Hikvision devices using the official SADP multicast protocol
• ARP Discovery: Find devices by scanning IP ranges and checking MAC addresses
• Combined Scanning: Use both methods for comprehensive network discovery
• Device Probing: Check device status and information
• ISAPI Device Info: Fetch /ISAPI/System/deviceInfo over HTTP with built-in RFC 2617 Digest authentication (no curl --digest needed)
• SADP Commands: Send SADP protocol commands to devices
• Password Reset Code Generation: Generate reset codes for devices with firmware < 5.3.0

Installation

From Source

# Clone the repository
git clone https://github.com/cameronnewman/hikvision-tooling.git
cd hikvision-tooling

# Build
make build

# Or install to your GOBIN
make install

Pre-built Binaries

Download pre-built binaries from the Releases page.

Usage

sadp <command> [options]

Commands

discover:sadp - SADP Protocol Discovery

Discover devices using SADP multicast (239.255.255.250:37020):

# Basic discovery
sadp discover:sadp

# With XML output
sadp discover:sadp --xml --output devices.xml

# With CSV output
sadp discover:sadp --csv

discover - ARP-based Discovery

Discover devices by scanning an IP range:

sadp discover 192.168.1.0/24
sadp discover --workers 50 10.0.0.0/24

scan - Combined Discovery

Use both ARP and SADP for comprehensive scanning:

sadp scan 192.168.1.0/24

probe - Device Information

Check device status and information:

sadp probe 192.168.1.64

isapi info - Device Information via ISAPI

Fetch /ISAPI/System/deviceInfo from a Hikvision device using HTTP Digest authentication. Returns model, serial, firmware, MAC, and related metadata.

sadp isapi info <HOST> [--username USER] [--password PASS] \
                       [--insecure] [--timeout DURATION] [--json]

The <HOST> may be 192.168.1.64, http://192.168.1.64, https://192.168.1.64:8443, or a plain hostname. Scheme defaults to http; port defaults to the scheme default (80/443).

Credentials come from HIKVISION_USERNAME / HIKVISION_PASSWORD (recommended) or the --username / --password flags. Flags leak into shell history — prefer the env vars.

Use --insecure to skip TLS verification for self-signed HTTPS. Use --json for machine-readable output. Exit codes: 0 success, 2 auth failure, 3 network/timeout, 1 other.

Example:

HIKVISION_USERNAME=admin HIKVISION_PASSWORD=xxxxx sadp isapi info 192.168.1.64

send - SADP Commands

Send SADP protocol commands to devices:

# List available commands
sadp send --list

# Send inquiry command
sadp send 192.168.1.64 inquiry

# Exchange code with a specific device
sadp send 192.168.1.64 exchangecode --mac 4C:BD:8F:61:CC:5C

# Target unknown IP (MAC required)
sadp send 0.0.0.0 exchangecode --mac 4C:BD:8F:61:CC:5C

# Force legacy direct-dial (rarely works, see below)
sadp send 192.168.1.64 inquiry --unicast

Transport: send writes the request to the SADP multicast group (239.255.255.250:37020) and to broadcast on every IPv4 interface, then correlates the reply back to the target MAC (preferred) or IP. This mirrors the official SADPTool and is required because Hikvision devices only listen for SADP on multicast/broadcast — unicast to <device-ip>:37020 is typically rejected (connection refused on Linux) or silently dropped (no response on Windows). Pass --unicast only if you have a device that behaves differently and want to force the legacy path.

reset - Password Reset Code Generator

Generate password reset codes for devices with firmware < 5.3.0:

# Manual input
sadp reset --serial 0123456789 --date 20231215

# Auto-fetch from device
sadp reset --ip 192.168.1.64

Important Notes:

• Serial number is case-sensitive
• Remove the model prefix from the serial number (e.g., DS-7616NI-I20123456789 → 0123456789)
• Date must match the device's internal clock, not today's date
• Only works on firmware versions < 5.3.0

Configuration

Configure the tool using environment variables:

Variable	Default	Description
DISCOVERY_WORKERS	100	Number of concurrent workers
DISCOVERY_TIMEOUT	1s	Per-host timeout for discovery
SADP_TIMEOUT	5s	SADP protocol timeout
HTTP_TIMEOUT	10s	HTTP request timeout
HIKVISION_USERNAME	(empty)	ISAPI digest-auth username
HIKVISION_PASSWORD	(empty)	ISAPI digest-auth password
USER_AGENT	Chrome UA string	User-Agent header for HTTP probes
OUTPUT_DIR	data	Directory used for generated output files
AES_KEY_HEX	Hikvision default	AES key used by the reset-code generator
XOR_KEY_HEX	Hikvision default	XOR key used by the reset-code generator
DEBUG	false	Enable debug output

Example:

DISCOVERY_WORKERS=50 SADP_TIMEOUT=10s sadp scan 192.168.1.0/24

Development

Prerequisites

• Go 1.26 or later
• golangci-lint (for linting)

Building

# Build for current platform
make build

# Build for all platforms
make release

# Run tests
make test

# Run tests with coverage
make test-cover

# Run linters
make lint

# Run all checks
make check

Project Structure

.
├── cmd/
│   └── sadp/           # CLI entry point
├── internal/
│   ├── cli/            # CLI commands and logic
│   ├── config/         # Environment-based configuration
│   ├── crypto/         # Password reset code generation
│   ├── isapi/          # ISAPI client (DeviceInfo over digest auth)
│   ├── logger/         # Structured logging (zap)
│   ├── network/        # HTTP client, digest transport, ARP, CIDR utils
│   └── sadp/           # SADP protocol implementation
├── Makefile
└── README.md

Protocol Information

SADP Protocol

SADP (Search Active Devices Protocol) is Hikvision's device discovery protocol:

• Multicast Address: 239.255.255.250
• Port: 37020
• Transport: UDP
• Format: XML-based messages

Hikvision OUI (MAC Prefixes)

The tool identifies Hikvision devices by their MAC address prefixes:

• 28:57:BE
• 4C:BD:8F
• 54:C4:15
• C0:56:E3
• E0:50:8B
• And more...

License

MIT License - see LICENSE for details.

Disclaimer

This tool is intended for legitimate network administration and security research purposes. Only use it on networks and devices you own or have explicit permission to test. The authors are not responsible for any misuse of this tool.

Contributing

Issues and pull requests are welcome. Before opening a PR, please run make check (formatting, go vet, linters, tests) and keep changes focused — smaller PRs land faster.